General

  • Target

    T8hSRQ9v.bat

  • Size

    191B

  • Sample

    191216-gpkwcwghx2

  • MD5

    f773c363fe378766f4649d3c4e14667c

  • SHA1

    44c9fed13edf783a27084d7d713b08b836efb0a9

  • SHA256

    860e1d41ffe08b8824745666ed8f193468561b25df91e56472a336b6c6307e0d

  • SHA512

    a9021477d95a6a8d0c7c494c123b55cb112227296b19067c70ec52cff6c1b1748d3a43d5e7d1d819d57c5d384c80756aa4b0d390717892b7c6af1cd11e474fec

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/T8hSRQ9v

Extracted

Path

C:\7l955-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7l955. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8950C755793BD156 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/8950C755793BD156 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WS58N2UExb2MpRwEcOOQqsuhwEO4bz6AyLbFsxFizQp+LpoTE/DIqsqobwsFJLJK NNSUnqVnD3OLAGUWVC9OKA4NF6Nro2kGyZrvgOj2nu0IEAZMXkKZ0yhPvTdl+tJU o60oFyDJ68VN/o7xwE1GtcTsxQWs2F3/cAGSzIRnqfInN2kZNkbbn+m+mwKHoBCY caP1FD5hy7ElsTDrEHbmcKvpcGZf/zIjILgkm3iUNcScZ70qholJDa9RdyMubZ4y HHFAZxLtjOUGDI/Elr6FEXb2kNEr6bShGQSq9GeZ726g/y6XYt241G2CL7UoVGxW IZeS4LEIxfvqQnRGwSes+swjUvhepqUbNYCIDu/psJg9VwnVv0MklDeg1HwUlX7A n51DXTdB+clo4N6Tmib7sUkw3zlQqxovAqJ/zvfpOCrFRW6VWBZKQoGXdbTn6ipx xdt2VJR1dbjxyWW6ZSHUFvQAwgrLnlj5VBGLomMYqXhR0O/d+boJin2a3PNYmgFc J8nZGIMkvMCQ5RTWkwBIbbTx8gr3J3L5GZdu3OlnYDAvF79pc6QIPqNgCUr4p00O Sq+tZQbl9GH8MkP+GgJLA/vdHGW9ylEN1iaRvYvH1tvURl+GE6IzVZ8QJzCq+Jq4 cipMTmZsbc/CV5xHJubgH/PDX1ZwKeOwJoiPIYm+vOs74yImEyw6MuX/0vY+gTNG YsExS9OSWfiGRg5XGWCfGaHMQkLzHjUN8ezJvjuNK1JW/lmjRpM7FLJUCSEYGu9Y ISUYDEBtUqAecZClmprVlmI6zNieP2cOEipzoUkSVkbxKgq6CYdS0iO7sNMtUTeu Sben1t1Sx7KYRZljQG2BzFw5q6V3PY3q/Gv2mPzi8Ig8EBbu7akZooLjsS3bTgMa 31sPInrPcGHrP1gR6wnWOT+p02IXOF1QNEvNjhBovHILYx8vWuf0S9cpkXl8Y+Zs h4vcskKhfwaQ3S7gXbPYr64tYfTrs4VlfzVWnDm60eFHW+bdZvxdO/AjyLLHoc7h I7eG9sB3PXa75FpGHJGG/deCth6E6bcvreuPkSKOuscM0q5n3176O8yMCaYBYlzV cuqqbHmD1S3hPAfSoih56EECifGs6YoJdNJ73LjYain9s8TOaX6M6tYB15cf9jy9 nH9DLfPnl6OSrA== Extension name: 7l955 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8950C755793BD156

http://decryptor.top/8950C755793BD156

Targets

    • Target

      T8hSRQ9v.bat

    • Size

      191B

    • MD5

      f773c363fe378766f4649d3c4e14667c

    • SHA1

      44c9fed13edf783a27084d7d713b08b836efb0a9

    • SHA256

      860e1d41ffe08b8824745666ed8f193468561b25df91e56472a336b6c6307e0d

    • SHA512

      a9021477d95a6a8d0c7c494c123b55cb112227296b19067c70ec52cff6c1b1748d3a43d5e7d1d819d57c5d384c80756aa4b0d390717892b7c6af1cd11e474fec

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Program crash

    • Windows security modification

    • Checks for installed software on the system

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks